CVE-2025-4035

Description

A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.

Reserved 2025-04-28 | Published 2025-04-29 | Updated 2025-05-26 | Assigner redhat

Problem types

Improper Handling of Case Sensitivity

Product status

Default status
affected

0:3.6.5-3.el10_0.6 before *
unaffected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Timeline

2025-04-28:	Reported to Red Hat.
2025-04-28:	Made public.

Credits

Red Hat would like to thank Jan Różański for reporting this issue.

References

access.redhat.com/errata/RHSA-2025:8128 (RHSA-2025:8128) vendor-advisory

access.redhat.com/security/cve/CVE-2025-4035 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2362651 (RHBZ#2362651) issue-tracking

cve.org (CVE-2025-4035)

nvd.nist.gov (CVE-2025-4035)

Download JSON